# Document evidence with chain of custody forms

Let's continue our discussion on how documentation provides transparency through documents like chain of custody.

During incident response, evidence must be accounted for during the entire incident's lifecycle.

Tracking evidence is important if the evidence is requested as part of any legal proceedings.

How can security teams ensure that this is done?

They use a form called chain of custody.

Chain of custody is the process of documenting evidence possession and control during an incident lifecycle.

As soon as evidence gets collected, chain of custody forms are introduced.

The forms should be filled out with details as the evidence is handled.

Let's examine a very simple example of how chain of custody is used during digital forensic analysis.

Previously, you learned that digital forensics is the practice of collecting and analyzing data to determine what has happened after an attack.

During an incident response, Aisha verified that a compromised hard drive requires examination by the forensics team.

First, she ensures that the hard drive is write protected, so the data on the disk can't be edited or erased.

Then, she calculates and records a cryptographic hash function of an image of the hard drive.

Remember that a hash function is an algorithm that produces a code that can't be decrypted.

Aisha is then instructed to transfer it to Colin in the forensics department.

Colin examines it and sends it off to Nav, another analyst.

Nav receives the compromised hard drive and sends it to her manager, Arman.

Each time the hard drive is transferred to another person, they need to log it in the chain of custody form, so that movement of evidence is transparent.

Tampering with the data on the hard drive can be detected using the original hash that Aisha documented at the beginning of the process.

This ensures that there's a paper trail describing who handled the evidence, and why, when, and where they handled it.

Just like other documentation types,

there is no standard template of what the chain of custody form should look like, but they do contain common elements.

This is what you might examine on a chain of custody log form.

First, there should be a description of the evidence, which includes any identifying information, like the location, hostname, MAC address, or IP address.

Next is the custody log, which details the name of the people who transferred and received the evidence.

It also includes the date and time the evidence was collected or transferred and the purpose of the transfer.

You may be wondering: what happens if evidence gets logged incorrectly?

Or, if there's a missing entry?

This is what's known as a broken chain of custody, which occurs when there are inconsistencies in the collection and logging of evidence in the chain of custody.

In the court of law, chain of custody documents help establish proof of the integrity, reliability, and accuracy of the evidence.

For evidence related to security incidents, chain of custody forms are used to help meet legal standards so that this evidence can be used in legal proceedings. If a malicious actor compromised a system, evidence must be available to determine their actions so that appropriate legal action can be taken.

However, in some cases, major breaks in the chain of custody can impact the integrity, reliability, and accuracy of the evidence.

This affects whether or not the evidence can be a trusted source of information and used in the court of law.

Chain of custody forms provide us with a method of maintaining evidence, so that malicious actors can be held responsible for their actions.